Back to home

Privacy Policy

Draft — this policy has not yet been reviewed by a lawyer.

This policy explains what personal data TradeRunner processes, why, and what your rights are.

Who is responsible

TradeRunner is operated by [PLACEHOLDER] (the "controller"). Questions or requests about your data: [PLACEHOLDER].

What we collect

  • -Account data — your name, email address and password (stored as a hash by our login system). If you sign in with Google, we receive your name and email from Google.
  • -Exchange API keys — your Bitvavo API key and secret, stored encrypted. They are used only to trade and read balances on your behalf.
  • -Trading data — your strategies, bots, and the orders and trades they place.
  • -Billing data — your subscription and invoices. Card details are entered on Stripe's own page and never reach us.

Why we use it

We process this data to provide the service you signed up for (performance of a contract), and billing and trade records because tax law requires us to keep them (legal obligation).

Cookies

We only set cookies that are strictly necessary, so we do not ask for consent:

  • -Login and security cookies — set by us and by our login service to keep you signed in and protect sign-in against forgery. Deleted when you sign out or the session expires.
  • -tr_theme and tr_lang — remember the theme and language you chose. Kept for one year.

We do not use advertising or tracking cookies.

Analytics

We measure page visits with Umami, a privacy-friendly analytics tool we host ourselves. It sets no cookies, does not store your IP address, and does not follow you across sites. We cannot identify you from it.

Who we share data with

  • -Cloudflare — delivers the website to you.
  • -Stripe — handles payments.
  • -Bitvavo — the exchange your bots trade on, reached with your own API key.
  • -Google — only if you choose to sign in with Google.
  • -Telegram — when you sign up, your email address is sent to the administrator via Telegram so your account can be approved.

Our servers are hosted at [PLACEHOLDER]. We never sell your data.

How long we keep it

  • -Exchange API keys — deleted immediately when you disconnect them.
  • -Account data — until you ask us to delete your account.
  • -Billing and trade records — 7 years, as required by Dutch tax law.

Your rights

You can ask to see, correct, export or delete your data, or object to how we use it. To delete your account, email [PLACEHOLDER]; we will do so within 30 days. You may also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Changes

If we change this policy we will update this page. Last updated: 30 September 2026.